How to Build a Business Continuity Plan

The historic flooding of Nashville in May 2010 was an unsettling reminder to business owners that disasters can and do happen. For a small business in particular, picking up the pieces and starting to serve customers again can be especially difficult after a major disruption. An estimated 25 percent of businesses never reopen their doors following a major disaster, according to the Institute for Business & Home Safety.

Most companies have insurance policies designed to cover the more obvious financial ramifications of incidents like fires, floods, or hurricanes. What insurance won't protect, however, is your reputation or market share, particularly if the disaster is specific to your business, such as a fire in your office building. Customers are likely to go to your competitors when you fail to provide products or services and are unable to notify them.

Establishing a framework for your employees to tackle the nightmarish process of notifying customers and reinstating timely delivery of products and services after a disaster is an essential long-term strategy for your business. It's known as a business continuity plan, a document that lists emergency contact information, backup suppliers, and a detailed recovery plan. Reaching the end goal of a written plan is the culmination of a long process involving many different parties. Here's how to get started.

Building a Business Continuity Plan: Size Up Your Risks

Business continuity planning begins with assessing how potential risks to your business will impact your ability to deliver products and services. By having a financial analysis of the impact of those risks, you will be able to prioritize the steps you take to repair your business after a disruption. 'It's an analysis of the impact to the business of a lack of something, like technology, people to do the job, or something as simple as a certain machine,' says Ted Brown, president and CEO of KETCHConsulting, a Waverly, Pennsylvania-based firm providing a range of disaster recovery services. 'A lot of people don't do that and end up investing in protection in the wrong areas.'

Start by defining what those risks are so you can look into ways to mitigate them. You can't plan for everything, but you should be aware of the risks that are statistically likely to happen to you, based on factors such as geography. 'The odds of a hurricane hitting a company on the coast of Florida are very high,' Brown says. 'The odds of one hitting Tulsa, Oklahoma, are very low.' You should also look around your workplace for smaller physical risks, he says, like having a hot plate near paper, a potential fire hazard.

According to the Federal Emergency Management Agency (FEMA), fire is actually the most common hazard to businesses. Here are a number of relatively simple steps FEMA advises you can take to limit fire risk:

Meet with your local fire department to have your facility inspected for fire hazards and to make sure it meets all fire codes and regulations.

Hand out fire safety information on how to prevent fires, how to contain fires, how to evacuate the building, and how to report fires.

Conduct evacuation drills.

Talk with your insurance carrier as well to find out what measures they recommend and to see if they offer fire prevention training.

Organize a safe disposal place for potentially combustible materials.

If you're in a geographical area where tornadoes or hurricanes are likely, FEMA recommends taking the following precautions:

Talk to local emergency departments about the community warning system and procedures, and any evacuation plans.

Work with a structural engineer to establish a safe shelter facility for personnel in your building. (This should be underground in the case of tornadoes.)

Design an effective evacuation plan and communicate it to employees.

Survey your building, and make plans to protect outside equipment. Make sure you have proper protection for your windows. (Permanent storm shutters are a safe bet.)

Flooding also can't be overlooked. Here's what FEMA recommends:

Review the geography of your building. Are you located in a flood plain? What's the elevation of your facility in relation to the closest river? Is there a history of flash flooding in your area? What's the fastest way to higher ground?

Talk to your insurance carrier about flood insurance.

Hire a professional to flood proof your facility. There are a variety of options and costs to doing so, from structural changes like reinforcing walls to resist water pressure and installing permanent pumps to remove water. There are also simpler precautions, such as buying battery-powered lighting and sandbags.

Now you need to think about who will be affected by your business disruption. Have a list of the contact information of your top customers and clients, so you can personally contact them about the situation and reassure them that you are well on your way to restoring operations. A good idea is to encourage employees to keep important contact information on their personal mobile phones. 'Who are the people we need to get in touch with the most and keep informed?' Brown says. 'The last thing you want is the media telling your customers what's happening to your business.'

You can't begin to recover your business without the right people. Determine which employees are critical to the functioning of your business, and organize an emergency contact list. The names on that list shouldn't be limited to executives; you need a diverse mix of personnel and a clear succession of management in case some employees are unable to work. If your office becomes inaccessible, you should have a prearranged meeting point. Also, find out who's able to work from home.

The trick is to be redundant. Arrange backup vendors or suppliers to provide you with critical resources and materials. Make sure you have a technology recovery plan, and that you have backed up important IT data like customer records and corporate documents. Back them up more than once, and arrange a secure, off-site storage location. Make sure the appropriate people have knowledge of relevant passwords and codes, and that you have backup tech vendors arranged.

Building a Business Continuity Plan: Know Your Business Inside and Out

The next step is learning the intricate details of how your business functions. 'In reality, the majority of organizations don't necessarily understand exactly where their profits are coming from, where their key missions are being driven from, and the key things they would need to be able to do and in what timeframe if that was disrupted,' says Lyndon Bird, international technical director of the Caversham, England-based Business Continuity Institute, which provides business continuity certification and guidance for companies around the world.

In order to dig into the details, start by identifying the critical products and services your company delivers, 'the profit centers,' as John Glenn, a certified Business Continuity Planner, puts it, and the key customers or clients they are delivered to. Then, figure out the employees who have the biggest role in delivering those products and services to those customers.

'Being able to wrap your mind around the core products and services gives you something tangible to work toward, and lets you identify the immediate steps you have to take to get back up and running,' says Brian Zawada, director of Avalution Consulting, a Cleveland, Ohio-based firm specializing in business continuity strategy. You'll obviously want everything running smoothly again as soon as possible, but it helps to establish a timeframe to prioritize what needs to be addressed in the first 24 to 48 hours, and what can wait until a few days after the disruption. Conducting such a business impact analysis will help you determine the maximum amount of time you can be out of the market.

It's a good idea to appoint someone (possibly yourself if you're a small business owner) to coordinate the efforts to create a business continuity plan, but a successful plan requires feedback and input from all parts of an organization. 'Never try to create a plan in a vacuum,' Glenn says. 'You need a dynamic group to get people together talking about exactly what they do and how they do it.'

You should solicit input from employees to determine their roles in the organization, and what tools they need to fulfill them, so you can write that into the plan in case someone else needs to take on those duties after a major disruption. And make sure each department or team of employees has developed their own plan to recover operations independently as well.

The most important part of the feedback process is constant communication among high-level management. The people who have fiduciary responsibility will be able to decide which objectives or functions of the business are most critical. Having upper-level management lead the effort also sends a clear message to employees that creating a strong continuity plan is a top priority, Bird says.

The document itself is the product of all this planning, analysis and input. It's your Bible when disaster strikes, so make sure it's clear, concise and simple enough for any employee to understand. It should address the basic questions of 'what are you going to do, where are you going to do it from, who is going to do it, and what resources, support, equipment, and facilities do you need to do that,' Bird says.

Make sure the document includes all the information you've gathered so far: supplier contact information, backup suppliers, employee contact information, the roles and responsibilities of key employees, major client contact information, backup equipment and IT data, and the place of the off-site recovery location. It should also establish a timeframe for getting this done, in order of priority. For example, it should clearly spell out what's accomplished within the first hour, within the first day, and within the first week.

Perhaps the most important step is to exercise and maintain your plan. 'An untested plan is a waste of time and money,' Brown says.

Your plan isn't going to be perfect the first time around. That's why you need to test it out, and make adjustments. This doesn't have to (and probably shouldn't) involve shutting down your business to see how your staff responds. Tabletop exercises, in which someone creates a scenario and the individuals around the table take on roles, can be an effective way to talk through the details of your plan, Brown says.

Creating a plan that allows your organization to stand up against a major disaster or disruption is a gradual process. 'You can't be perfect right out of the gate,' Zawada says. 'You need to create an expectation of continuous improvement and realize it's not just a project, but a long term goal. It is a simple concept, but the devil's in the details and the execution.'